The scan of github.com on 19 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with github.com?

2 analysed samples communicate with this URL, including Gootloader.

How was github.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

github.com - URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned github.com and returned a unknown verdict (score -6). The page resolved to 4.237.22.38 on Microsoft Corporation in AU. The domain was registered 6888 days ago through MarkMonitor Inc.. 17 domains and 2 IPs were contacted, over 11 HTTP requests. 2 malware samples communicate with this URL (Gootloader). The request followed 2 redirects before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -6) · Confidence 12%
Scanned URL: http://cherne.net/brian/resources/jquery.hoverIntent.html
Domain: github.com · IP: 4.237.22.38 · AS8075 · AU
Server: github.com
Page title: GitHub - briancherne/jquery-hoverIntent: hoverIntent jQuery Plug-in · GitHub
HTTP status: 200 · text/html; charset=utf-8
Registrar: MarkMonitor Inc. · domain age 6888 days · created 2007-10-09
TLS issuer: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36 · valid to Sep 30 23: · subject CN=github.com
HTTP requests captured: 11
Scan tier: fast · observed 2026-08-19 18:17:00 UTC

Redirect chain

http://cherne.net/brian/resources/jquery.hoverIntent.html
https://cherne.net/brian/resources/jquery.hoverIntent.html
https://github.com/briancherne/jquery-hoverIntent

Malware communicating with this URL (2)

These samples were observed contacting or being served from github.com. Each links to its full analysis.

e10f2a1e2dd8f9b6de2dba4dc6834c0b89fe52f1fe3918f71cd29529edb5244e - referenced · e10f2a1e2dd8f9b6de2dba4dc6834c0b · first seen 2026-08-19
Gootloader - referenced · a219dfaf4b5acc45855fdd5fc1e5278f · first seen 2026-08-19

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Cross-host redirect chain

Detected technologies

GitHub Pages
jQuery

Contacted infrastructure

4.237.22.38 - AS8075 Microsoft Corporation (Australia)
162.241.226.190 - AS46606 Unified Layer (United States)

Observed indicators

github.com
github.githubassets.com
avatars.githubusercontent.com
github-cloud.s3.amazonaws.com
user-images.githubusercontent.com
docs.github.com
github.blog
skills.github.com
support.github.com
securitylab.github.com
maintainers.github.com
stars.github.com
archiveprogram.github.com
api.jquery.com
briancherne.github.io
www.githubstatus.com
github.community
4.237.22.38
162.241.226.190
https://github.com/briancherne/jquery-hoverIntent

Other scans of github.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown · https://s.ai/
24 Aug 2026 - unknown · https://dub.co/?dub_id=CEIn8tRX42GwDoPJ
24 Aug 2026 - unknown · https://getbootstrap.com/
24 Aug 2026 - unknown · https://jqueryui.com/demos/effect/easing.html
24 Aug 2026 - unknown · https://upx.github.io/
24 Aug 2026 - unknown · https://www.split-code.com/
24 Aug 2026 - suspicious · https://gsgd.co.uk/sandbox/jquery/easing/
24 Aug 2026 - unknown · http://malsup.com/jquery/block/
24 Aug 2026 - suspicious · https://developer.wordpress.org/rest-api/
24 Aug 2026 - suspicious · https://dimsemenov.com/plugins/magnific-popup/documentation.html

Questions about github.com

Is github.com safe?: The scan of github.com on 19 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with github.com?: 2 analysed samples communicate with this URL, including Gootloader.
How was github.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of github.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan